Stored XSS in Your Answer in answerdev/answer
Valid
Reported on
Jan 12th 2023
Description
Evil users can attack other users or administrator users through this vulnerability, causing other users/administrator user accounts to be taken over
Proof of Concept
step1. Insert xss payload in the hyperlink of the question answer
javaScript:alert(localStorage.getItem('_a_lui_'))
step2. Any user can click this answer to trigger xss vulnerability to obtain access_ token
Impact
Executing JavaScript in victim's session which leads to potential account takeover, perform actions as that user, ...
Occurrences
markdown.go L14-L30
By default, goldmark does not render raw HTML or potentially-dangerous URLs. If you need to gain more control over untrusted contents, it is recommended that you use an HTML sanitizer such as bluemonday.
We are processing your report and will contact the
answerdev/answer
team within 24 hours.
a year ago
A
GitHub Issue
asking the maintainers to create a
SECURITY.md exists
a year ago
We have contacted a member of the
answerdev/answer
team and are waiting to hear back
a year ago
We have sent a
follow up to the
answerdev/answer
team.
We will try again in 7 days.
10 months ago
The researcher's credibility has increased: +7
The fix bounty has been dropped
This vulnerability has been assigned a CVE
markdown.go#L14-L30
has been validated
to join this conversation